findstr — Windows text and configuration searching

findstr searches text inside files. It is the native Windows CMD equivalent of a basic grep workflow and is extremely useful when analysing configuration files, scripts, logs and CTF artefacts.

/i ignores uppercase and lowercase differences. This is useful when the exact capitalisation of a value is unknown.

/n shows the line number where each match was found.

/s searches matching files in the current directory and every subdirectory.

/p skips files containing non-printable characters. This reduces noise when recursively searching large directory trees.

Combining /s, /p, /i and /n gives recursive searching, skips many binary files, ignores case and displays line numbers.

/c treats the supplied text as a single search string. It is especially useful when searching strings containing spaces or specific flag prefixes.

Multiple /c options allow several interesting values to be searched in a single command.

Instead of scanning every file type, restricting findstr to common configuration extensions is faster and produces cleaner output.

Configuration files frequently contain key-value pairs. In CTF environments useful search terms include password, secret, token, key and connection strings.

Searching for assignment syntax can reduce matches from documentation or comments.

Windows and .NET applications frequently use XML-based configuration files.

Modern applications commonly store configuration in JSON or YAML files.

Batch and PowerShell scripts can reveal application paths, usernames, scheduled operations and other useful CTF context.

/m prints only the names of files containing matching text. This is useful for reducing output before manually inspecting interesting files.

Changing into the user profile before recursively searching keeps the scope manageable.

ProgramData is a useful application configuration location on Windows.

On Windows web servers, web.config and application files under inetpub are useful targets during authorised lab enumeration.

PowerShell history is plain text and can be searched directly when it exists and permissions allow access.

Windows installation and deployment configuration can exist under C:\Windows\Panther. In training environments these files are worth reviewing separately.

dir and findstr also work together when the goal is to filter filenames and paths rather than file contents.

Piping dir into findstr searches the path or filename itself. Running findstr directly against files searches their contents. Understanding this difference avoids confusion during enumeration.

Searching an entire C: drive recursively can be slow and noisy. Start with user profiles, ProgramData, web roots and known application directories before expanding the scope.

findstr is useful but its regular-expression engine is much more limited than grep, ripgrep or PowerShell Select-String. It may also behave poorly with binary files, Unicode encodings and very long lines. Use it primarily as a fast native Windows search tool.